Privacy Policy

Effective 21 August 2026

This Privacy Policy explains how Security Consultants OÜ (“Security Consultants”, “SC”, “we”, “us”) processes personal data in connection with the Client Portal available at portal.security-consultant.com (the “Portal”). It applies only to the Portal application itself. For how we handle personal data on our corporate website and in our general business dealings, see our corporate Privacy Policy.

1. Who we are

Security Consultants OÜ is a company registered in Estonia, with its registered office at Tiskrevälja tn 59-12, Tallinn, 13516, Estonia. We provide cybersecurity, privacy, and compliance consulting services, including the compliance-tracking and reporting functionality made available to our clients through the Portal.

2. Our role: controller and processor

We act as a data controller for the limited personal data needed to operate your Portal account and keep it secure — your work email address, sign-in and session records, and the audit logs described in Section 3.

We act as a data processor for the security program data displayed inside the Portal — certifications, vulnerability scan results, compliance test outcomes, and security awareness metrics. That data belongs to, and is controlled by, the organisation that engaged us (your employer), under the Master Service Agreement and Data Processing Agreement between Security Consultants OÜ and that organisation. If you have questions about how your employer's data is used, contact your organisation directly, or ask your Security Consultants engagement lead to put you in touch.

3. Personal data we collect

The Portal is designed to collect the minimum personal data needed to authenticate you and keep your account secure:

• Account identifiers. Your work email address, used to send you a sign-in link, or, where your organisation uses single sign-on, the identifier your identity provider supplies.
• Authentication and session records. Sign-in link issuance and consumption events, session cookie start and expiry times, and membership status. Session identifiers are opaque and are never paired with your email address, employer, or client identifier in a way a third party could read.
• Security and abuse-prevention data. To rate-limit sign-in attempts and detect abuse, we temporarily process a salted, one-way hash of your IP address and browser identifier. We do not retain raw IP addresses for this purpose.
• Audit logs. Access to your organisation's data is logged using opaque internal identifiers (membership and principal IDs) rather than your name or email address, together with the outcome of the request and a timestamp.
• Technical performance data. We use Vercel Speed Insights, a cookieless tool, to measure page load performance. It does not identify you individually.

We do not use advertising or cross-site tracking cookies, and we do not sell personal data.

4. How we use personal data, and our legal basis

• To provide the Portal (performance of a contract, Art. 6(1)(b) GDPR) — authenticating you, maintaining your session, and displaying the security program data your access rights entitle you to see.
• To keep the Portal secure (legitimate interests, Art. 6(1)(f) GDPR) — detecting and preventing unauthorised access, credential abuse, and rate-limit evasion.
• To meet legal obligations (Art. 6(1)(c) GDPR) — where we are required to retain records or respond to a lawful request from a competent authority.

5. Cookies

The Portal sets one strictly necessary cookie, portal.sid, which identifies your authenticated session. It is HTTP-only, scoped to the Portal domain, and expires automatically after 12 hours or when you sign out. We do not set analytics, advertising, or preference cookies. Because this cookie is essential to the Portal's operation, it is set without a separate consent banner, consistent with Article 5(3) of the ePrivacy Directive and equivalent UK PECR guidance for strictly necessary cookies.

6. Who we share data with

We do not sell your personal data. We share it only with service providers who process it on our behalf, under contractual confidentiality and security obligations, specifically:

• Vercel Inc. — application hosting and content delivery.
• Neon Inc. — managed PostgreSQL database hosting (EU region, Frankfurt) for account, membership, and security-program data.
• Resend — delivery of sign-in link emails, where your organisation uses email-based sign-in.
• Microsoft — identity verification, where your organisation instead uses single sign-on through Microsoft Entra External ID.

We may also disclose personal data where required by law, to protect our rights or the security of the Portal, or in connection with a merger, acquisition, or sale of assets, subject to confidentiality commitments consistent with this Policy.

7. International data transfers

Account, membership, and security-program data are stored in a Postgres database located in the European Union (Frankfurt, Germany). Some service providers listed in Section 6 may process data outside the European Economic Area or the United Kingdom, including in the United States. Where they do, we rely on the EU-US Data Privacy Framework, its UK extension, and/or Standard Contractual Clauses to ensure an adequate level of protection.

8. Data retention

• Sign-in links are single-use and expire after 15 minutes.
• Sessions expire automatically after 12 hours.
• Membership records are retained for the duration of your organisation's active engagement with Security Consultants OÜ, and for a limited period afterward to support account recovery and legal or contractual record-keeping, after which they are deleted or anonymised.
• Security and audit logs are retained only as long as needed for the security purpose described in Section 4, and in any case no longer than our standard log retention window.

9. Security measures

The Portal is built to a fail-closed standard: access is re-verified against our authorisation store on every request, sessions carry no client identifier or access-control list that could be tampered with, and logs use opaque identifiers rather than names, emails, or the underlying security findings themselves. Data in transit is encrypted with TLS; data at rest is encrypted by our infrastructure providers. Database roles are scoped to the minimum privilege required for each function.

10. Your rights

Depending on where you live, you may have the right to: request access to the personal data we hold about you; request correction of inaccurate data; request erasure; restrict or object to processing; request a portable copy of your data; and lodge a complaint with a supervisory authority — in Estonia, the Estonian Data Protection Inspectorate (AKI), in the UK, the Information Commissioner's Office, or your local equivalent. To exercise any of these rights over the account data described in Section 3, contact us using the details in Section 13. Requests concerning the security program data we process on your employer's behalf should generally be directed to your employer, who is the controller of that data.

11. Children's privacy

The Portal is a business tool intended for use by adult employees and contractors of our client organisations. It is not directed at, and we do not knowingly collect personal data from, individuals under the age of 18.

12. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to the Portal or our legal obligations. We will update the effective date above when we do. Material changes will be communicated to active Portal users where feasible.

13. Contact us

For questions about this Policy or to exercise your rights under Section 10, contact us at hello@security-consultant.com or through our Privacy Contact Form. For matters relating to your underlying consulting engagement, please also loop in your Security Consultants engagement lead.